Total
398081 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-19589 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0. | |||||
| CVE-2026-19016 | 2026-08-28 | N/A | 4.2 MEDIUM | ||
| Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. | |||||
| CVE-2026-19113 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. | |||||
| CVE-2026-5006 | 2026-08-28 | N/A | 6.8 MEDIUM | ||
| A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy. This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20. | |||||
| CVE-2026-12624 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19. | |||||
| CVE-2026-21751 | 2026-08-28 | N/A | 7.4 HIGH | ||
| HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached. | |||||
| CVE-2026-21754 | 2026-08-28 | N/A | 5.4 MEDIUM | ||
| HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications. | |||||
| CVE-2025-62341 | 2026-08-28 | N/A | 3.7 LOW | ||
| HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass. | |||||
| CVE-2025-62300 | 2026-08-28 | N/A | 5.9 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | |||||
| CVE-2025-68825 | 2026-08-28 | N/A | 7.5 HIGH | ||
| HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications. | |||||
| CVE-2025-62299 | 2026-08-28 | N/A | 6.6 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | |||||
| CVE-2026-21758 | 2026-08-28 | N/A | 3.7 LOW | ||
| HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment. | |||||
| CVE-2026-21752 | 2026-08-28 | N/A | 7.5 HIGH | ||
| HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws. | |||||
| CVE-2026-21753 | 2026-08-28 | N/A | 4.2 MEDIUM | ||
| HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment. | |||||
| CVE-2025-62342 | 2026-08-28 | N/A | 6.4 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion. | |||||
| CVE-2025-62307 | 2026-08-28 | N/A | 5.4 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing. | |||||
| CVE-2025-62343 | 2026-08-28 | N/A | 3.1 LOW | ||
| HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion. | |||||
| CVE-2026-21759 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface. | |||||
| CVE-2026-21755 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service. | |||||
| CVE-2026-56547 | 2026-08-28 | N/A | 3.5 LOW | ||
| The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user. | |||||